Determine the internal user private ip behind the firewall?

You can use the log files on the firewall to determine how many times a particular user accesses the webmail from their IP address.